OH-MY-DC: OIDC Misconfigurations in CI/CD

Unit 42 analyzed the use of OpenID Connect (OIDC) in CI/CD pipelines and discovered critical misconfigurations that can enable attackers to access cloud resources. The report highlights three main risks—overly permissive identity federation policies, trusting user-controllable claims (and unsafe custom sub formats), and combining poisoned pipeline execution with lax federation—and documents a real-world vendor issue in CircleCI that was remediated; it concludes with recommendations for repository-specific federation rules, strict claim validation, CI hardening, and tooling to detect these misconfigurations.